Memory leak on yr_rules_scan_proc

[TJOSERAFAEL]

YARA Version	Platform
3.9.0, 3.10.0	Ubuntu 16.04

When running processes scan using yr_rules_scan_proc function, a struct doesn't get freed if it can not attach to the process.

Simple POC:

#include <stdio.h>
#include <yara.h>

#define MAX_PIDS 32568

int main(int argc, char **argv)
{

   if (yr_initialize())
   {
      perror("Error initializing yara library\n");
      exit(1);
   }

   YR_COMPILER *compiler = NULL;

   if (yr_compiler_create(&compiler) != ERROR_SUCCESS)
   {
      perror("Error initializing yara compiler\n");
      exit(1);
   }

   YR_RULES *rules = NULL;

   if (yr_compiler_add_string(compiler, "rule dummy { condition: true }", NULL) != 0)
   {
      perror("Error on yr_compiler_add_string\n");
      exit(1);
   }

   if (yr_compiler_get_rules(compiler, &rules) != ERROR_SUCCESS)
   {
      perror("Error on yr_compiler_get_rules\n");
      exit(1);
   }

   printf("Yara initialized\n");

   int z;
   for (z = 0; z < MAX_PIDS; z++) {
      yr_rules_scan_proc(rules,z,0,NULL,NULL,0);
   }

   printf("Yara finalized\n");

   yr_compiler_destroy(compiler);

   yr_finalize();

   return 0;
}

Valgrind output:

==11936== 
==11936== HEAP SUMMARY:
==11936==     in use at exit: 1,785,936 bytes in 32,393 blocks
==11936==   total heap usage: 103,273 allocs, 70,880 frees, 22,303,851 bytes allocated
==11936== 
==11936== 56 bytes in 1 blocks are possibly lost in loss record 2 of 7
==11936==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11936==    by 0x4E70454: yr_process_open_iterator (in /usr/local/lib/libyara.so.3.9.0)
==11936==    by 0x4E79AAD: yr_rules_scan_proc (in /usr/local/lib/libyara.so.3.9.0)
==11936==    by 0x400AD5: main (main2.c:41)
==11936== 
==11936== 13,472 bytes in 1 blocks are possibly lost in loss record 4 of 7
==11936==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11936==    by 0x4E58D23: yr_arena_duplicate (in /usr/local/lib/libyara.so.3.9.0)
==11936==    by 0x4E5DEF6: yr_compiler_get_rules (in /usr/local/lib/libyara.so.3.9.0)
==11936==    by 0x400A85: main (main2.c:31)
==11936== 
==11936== 16,808 (112 direct, 16,696 indirect) bytes in 1 blocks are definitely lost in loss record 6 of 7
==11936==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11936==    by 0x4E5DEDA: yr_compiler_get_rules (in /usr/local/lib/libyara.so.3.9.0)
==11936==    by 0x400A85: main (main2.c:31)
==11936== 
==11936== 1,755,600 bytes in 31,350 blocks are definitely lost in loss record 7 of 7
==11936==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11936==    by 0x4E70454: yr_process_open_iterator (in /usr/local/lib/libyara.so.3.9.0)
==11936==    by 0x4E79AAD: yr_rules_scan_proc (in /usr/local/lib/libyara.so.3.9.0)
==11936==    by 0x400AD5: main (main2.c:41)
==11936== 
==11936== LEAK SUMMARY:
==11936==    definitely lost: 1,755,712 bytes in 31,351 blocks
==11936==    indirectly lost: 16,696 bytes in 1,040 blocks
==11936==      possibly lost: 13,528 bytes in 2 blocks
==11936==    still reachable: 0 bytes in 0 blocks
==11936==         suppressed: 0 bytes in 0 blocks
==11936== 
==11936== For counts of detected and suppressed errors, rerun with: -v
==11936== ERROR SUMMARY: 4 errors from 4 contexts (suppressed: 0 from 0)

Seems like this function doesn't free the iterator struct if the result fails:
https://github.com/VirusTotal/yara/blob/v3.10.0/libyara/rules.c#L361

Thank you!

[plusvic]

You need to call yr_rules_destroy for freeing the rules after the loop. That's probably the cause of the leak, the iterator struct is allocated in the stack and can't be leaked. El mié., 29 may. 2019 15:22, Jose Rafael Cenit <notifications@github.com> escribió:

…

YARA Version Platform 3.9.0, 3.10.0 Ubuntu 16.04 When running processes scan using yr_rules_scan_proc function, a struct doesn't get freed if it can not attach to the process. Simple POC: #include <stdio.h> #include <yara.h> #define MAX_PIDS 32768 int main(int argc, char **argv) { if (yr_initialize()) { perror("Error initializing yara library\n"); exit(1); } YR_COMPILER *compiler = NULL; if (yr_compiler_create(&compiler) != ERROR_SUCCESS) { perror("Error initializing yara compiler\n"); exit(1); } YR_RULES *rules = NULL; if (yr_compiler_add_string(compiler, "rule dummy { condition: true }", NULL) != 0) { perror("Error on yr_compiler_add_string\n"); exit(1); } if (yr_compiler_get_rules(compiler, &rules) != ERROR_SUCCESS) { perror("Error on yr_compiler_get_rules\n"); exit(1); } printf("Yara initialized\n"); int z; for (z = 0; z < MAX_PIDS; z++) { yr_rules_scan_proc(rules,z,0,NULL,NULL,0); } printf("Yara finalized\n"); yr_compiler_destroy(compiler); yr_finalize(); return 0; } Valgrind output: ==11936== ==11936== HEAP SUMMARY: ==11936== in use at exit: 1,785,936 bytes in 32,393 blocks ==11936== total heap usage: 103,273 allocs, 70,880 frees, 22,303,851 bytes allocated ==11936== ==11936== 56 bytes in 1 blocks are possibly lost in loss record 2 of 7 ==11936== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==11936== by 0x4E70454: yr_process_open_iterator (in /usr/local/lib/libyara.so.3.9.0) ==11936== by 0x4E79AAD: yr_rules_scan_proc (in /usr/local/lib/libyara.so.3.9.0) ==11936== by 0x400AD5: main (main2.c:41) ==11936== ==11936== 13,472 bytes in 1 blocks are possibly lost in loss record 4 of 7 ==11936== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==11936== by 0x4E58D23: yr_arena_duplicate (in /usr/local/lib/libyara.so.3.9.0) ==11936== by 0x4E5DEF6: yr_compiler_get_rules (in /usr/local/lib/libyara.so.3.9.0) ==11936== by 0x400A85: main (main2.c:31) ==11936== ==11936== 16,808 (112 direct, 16,696 indirect) bytes in 1 blocks are definitely lost in loss record 6 of 7 ==11936== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==11936== by 0x4E5DEDA: yr_compiler_get_rules (in /usr/local/lib/libyara.so.3.9.0) ==11936== by 0x400A85: main (main2.c:31) ==11936== ==11936== 1,755,600 bytes in 31,350 blocks are definitely lost in loss record 7 of 7 ==11936== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==11936== by 0x4E70454: yr_process_open_iterator (in /usr/local/lib/libyara.so.3.9.0) ==11936== by 0x4E79AAD: yr_rules_scan_proc (in /usr/local/lib/libyara.so.3.9.0) ==11936== by 0x400AD5: main (main2.c:41) ==11936== ==11936== LEAK SUMMARY: ==11936== definitely lost: 1,755,712 bytes in 31,351 blocks ==11936== indirectly lost: 16,696 bytes in 1,040 blocks ==11936== possibly lost: 13,528 bytes in 2 blocks ==11936== still reachable: 0 bytes in 0 blocks ==11936== suppressed: 0 bytes in 0 blocks ==11936== ==11936== For counts of detected and suppressed errors, rerun with: -v ==11936== ERROR SUMMARY: 4 errors from 4 contexts (suppressed: 0 from 0) Seems like this function doesn't free the iterator struct if the result fails: https://github.com/VirusTotal/yara/blob/v3.10.0/libyara/rules.c#L361 Thank you! — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1070?email_source=notifications&email_token=AABMVGOW5V2F5AEGZ4IMWGTPXZ7RDA5CNFSM4HQMXOMKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4GWPPVIA>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABMVGP65VMRCSZ633EU3PLPXZ7RDANCNFSM4HQMXOMA> .

[TJOSERAFAEL]

Hi @plusvic ,

the memory leak is still present even after calling yr_rules_destroy. Any thoughts on this?

Regards.

[plusvic]

You're right, there was a memory leak when _yr_process_attach failed. The issue should be solved with #1075. Can you verify?

[TJOSERAFAEL]

Hi @plusvic ,

the memory leak is fixed, thank you a lot!.
Do you have an ETA for including this on the https://github.com/VirusTotal/yara/tree/v3.10.0 tag?

Regards.

[plusvic]

It has been merged in master and will be included in the next release, but I don't have an ETA for it.